Cookie hijacking targets the session cookies that websites use to remember logged-in users. Infostealer malware copies these cookies alongside passwords, giving criminals two paths into the same account. Cookie-based access is especially dangerous for cloud admin consoles, email portals, and collaboration tools.
Defenders should treat cookie exposure from stealer logs with the same urgency as password leaks. Revoking sessions, invalidating refresh tokens, and enforcing re-authentication limits the window attackers have to exploit stolen cookies.
Read about cookie-driven access in SSO brute-forcing via infostealers and real breach chains in our Vercel breach analysis.